sunloginclient

MEDIUM

maintainer TimWcx 21 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted but plausibly official host (down.oray.com), which is unpacked and installed; while the host is not on a standard whitelist, it belongs to the vendor (oray.com), and the checksum is provided for the binary payload, reducing risk, but the source is a prebuilt executable with a SKIP'd checksum on the license file, constituting a moderate supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 'LICENSE::https://service.oray.com/question/1820.html')
PKGBUILD:25 source_x86_64=("https://down.oray.com/sl/linux/${_debname}-${pkgver}-x86_64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-whitelisted but plausibly official host (down.oray.com), which is unpacked and installed; while the host is not on a standard whitelist, it belongs to the vendor (oray.com), and the checksum is provided for the binary payload, reducing risk, but the source is a prebuilt executable with a SKIP'd checksum on the license file, constituting a moderate supply-chain risk.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: yjun <jerrysteve1101 at gmail dot com>
    
      2# Maintainer: zhullyb <zhullyb at outlook dot com>
    
      3# Maintainer: TimWcx <timwcx at qq dot com>
    
      4
    
      5pkgname=sunloginclient
    
      6_pkgname=awesun
    
      7_debname=awesun
    
      8pkgver=16.5.0.30560
    
      9pkgrel=10
    
      10pkgdesc="Proprietary software that supports remote control of mobile devices, Windows, Mac, Linux and other systems.(GUI version)"
    
      11arch=("x86_64")
    
      12url="https://sunlogin.oray.com"
    
      13depends=("gtk3"
    
      14         'libnotify'
    
      15         'libepoxy'
    
      16         'libappindicator-gtk3'
    
      17         'webkit2gtk-4.1'
    
      18         'util-linux-libs'
    
      19         'libcrypt.so=1-64')
    
      20license=('custom')
    
      21provides=('sunlogin'
    
      22          'awesun')
    
      23source=("runsunloginclient.service"
    
      24        'LICENSE::https://service.oray.com/question/1820.html')
    
      25source_x86_64=("https://down.oray.com/sl/linux/${_debname}-${pkgver}-x86_64.deb")
    
      26install="${pkgname}.install"
    
      27options=(!strip emptydirs)
    
      28sha256sums=('31a15b3da81917f13eab0e34a2ea7fb50b33af20e6cebf3779f188571d459501'
    
      29            'SKIP')
    
      30sha256sums_x86_64=('eda3fffe6d5324afbc4f939f0cb85c08b7851efad3c01878621474ec7503d10f')
    
      31
    
      32_opt_path="/opt/${_pkgname}"
    
      33_orig_path="/usr/local/${_pkgname}"
    
      34
    
      35build() {
    
      36  mkdir -p build
    
      37  tar -xf data.tar.xz -C build
    
      38}
    
      39
    
      40package() {
    
      41  cd build
    
      42
    
      43  # install the whole awesun tree (bin/ lib/ data/ scripts/ + launcher)
    
      44  install -dm755 "${pkgdir}/opt"
    
      45  cp -a "usr/local/${_pkgname}" "${pkgdir}/opt/"
    
      46
    
      47  # relocate the hardcoded /usr/local/awesun prefix to /opt/awesun in every file
    
      48  local _pad_path="///////opt/${_pkgname}"
    
      49  while IFS= read -r -d '' _f; do
    
      50    sed -i "s#${_orig_path}#${_pad_path}#g" "$_f"
    
      51  done < <(grep -RslZ "${_orig_path}" "${pkgdir}${_opt_path}")
    
      52  
    
      53  # relocate paths in the helper scripts (plain text)
    
      54  sed -i "s#${_pad_path}#${_opt_path}#g" "${pkgdir}${_opt_path}/scripts/"*
    
      55
    
      56  # oray config file
    
      57  install -Dm644 /dev/null "${pkgdir}/etc/orayconfig.conf"
    
      58
    
      59  # system service
    
      60  install -Dm644 "${srcdir}/run${pkgname}.service" \
    
      61    -t "${pkgdir}/usr/lib/systemd/system/"
    
      62
    
      63  # runtime log dir (matches upstream postinst)
    
      64  install -dm777 "${pkgdir}/var/log/${_pkgname}"
    
      65
    
      66  # desktop entry
    
      67  install -Dm644 "usr/share/applications/${_pkgname}.desktop" \
    
      68    -t "${pkgdir}/usr/share/applications/"
    
      69  sed -i -e "s#Exec=${_orig_path}/awesun#Exec=${_opt_path}/awesun#g" \
    
      70         -e "s#Icon=${_orig_path}/awesun.png#Icon=${pkgname}#g" \
    
      71    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      72
    
      73  # icon
    
      74  install -Dm644 "usr/local/${_pkgname}/awesun.png" \
    
      75    "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      76
    
      77  # launcher symlinks
    
      78  install -dm755 "${pkgdir}/usr/bin"
    
      79  ln -sf "${_opt_path}/awesun" "${pkgdir}/usr/bin/${pkgname}"
    
      80  ln -sf "${_opt_path}/awesun" "${pkgdir}/usr/bin/${_pkgname}"
    
      81
    
      82  # license
    
      83  install -Dm644 "${srcdir}/LICENSE" \
    
      84    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      85}
    
      86# vim: ts=2 sw=2 et:
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2